Firefly Pros & Cons: What Nobody Tells You [2026]

Firefly connects to AWS, Azure, and Google Cloud using read-only IAM permissions and automatically scans all regions and accounts to discover resources. The AI agents map relationships between resources — like how EC2 instances relate to security groups and networking configurations, or how Lambda functions connect to API Gateways and DynamoDB tables. Discovery is continuous rather than periodic, meaning new resources are detected within minutes of creation. The platform builds a dependency graph that visualizes infrastructure topology, helping teams understand blast radius for changes and identify orphaned resources that accumulate cost without serving active workloads.

Firefly requires read-only access to your cloud accounts with permissions to list and describe resources but cannot modify or delete anything directly. The specific permissions include resource enumeration rights across all services, cost and billing data access for optimization insights, and CloudTrail or equivalent audit log access for change attribution. For AWS, this translates to a custom IAM role with ViewOnly and SecurityAudit managed policies. For Azure, a Reader role at the subscription level suffices. Firefly provides pre-built CloudFormation and Terraform templates to provision these permissions securely, and all credential handling follows least-privilege principles with no persistent credential storage.

Yes — Comtech's Paul Hohberg documented $180,000 in annual savings using Firefly, calling it 'phenomenal' that the savings paid for the platform three times over. Firefly identifies unused resources, right-sizing opportunities based on actual usage patterns, and end-of-life instances that should be decommissioned. The platform runs automated cost campaigns that surface savings opportunities with specific remediation steps, quantifying the dollar impact of each recommendation. Teams can track savings over time through dashboards that attribute cost reductions to specific governance actions, providing clear ROI metrics for FinOps initiatives.

Firefly integrates with Terraform, Pulumi, CloudFormation, and other IaC tools to identify drift between your code and actual cloud state. A core differentiator is IaC Adoption — Firefly can generate IaC templates for unmanaged resources to bring them under governance without manual code writing. The AI agents analyze resource configurations and produce production-ready Terraform modules or Pulumi programs that teams can review, customize, and merge into their existing repositories. This enables organizations to achieve full IaC coverage progressively, rather than requiring a disruptive 'big bang' migration that halts other development work.

Firefly's disaster recovery capability uses Infrastructure-as-Code as the source of truth to rebuild cloud environments instantly after outages, accidental deletions, or cyberattacks. Unlike traditional backup tools that restore data snapshots, Firefly restores the entire cloud infrastructure configuration — networking rules, IAM policies, compute instances, storage buckets, and service integrations — from versioned IaC code stored in Git. This means teams can recreate a complete production environment from scratch in minutes rather than days, which is critical during ransomware attacks where existing infrastructure cannot be trusted. The approach also provides inherent documentation of what was running, enabling forensic analysis alongside rapid recovery.